Decision 057/2008 Mr Martin Wilson and Greater Glasgow and Clyde Health Board
Communications relating to the applicant
Reference No: 200700989
Decision Date: 20 May 2008
Summary
Mr Wilson requested information relating to his personal injury claim from Greater Glasgow & Clyde NHS Board (the Board). The Board responded by withholding the information under section 38(1)(a) of the Freedom of Information (Scotland) Act 2002) (FOISA), but providing the information requested under the terms of the DPA.Following a review, Mr Wilson remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Board had partially failed to deal with Mr Wilson's request for information in accordance with Part 1 of FOISA, by failing to respond to Mr Wilson's request for information within the timescale set out in section 10(1) of FOISA.However the Commissioner found that the Board had acted in accordance with Part 1 of FOISA in withholding the information requested by Mr Wilson in terms of section 38(1)(a) of FOISA, accepting that no further relevant information was held.He did not require the Board to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General entitlement); 2 (Effect of exemptions); 10(1) (Time for compliance); and 38(1)(a) (Personal information).
Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data" and "data subject").
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 14 February 2007, Mr Wilson wrote to the Board, requesting the following information:
"...copies of all correspondence from 1995 to the present day which mentions my claim for Personal Injury, together with all records of any requests made by each of the following firms of solicitors [Balfour & Manson, Digby Brown and Thompsons] to Mr Wheelwright requesting he provide a medico-legal report".
2.Mr Wilson wrote to the Board on 20 March 2007, followed by an email on 22 March 2007, requesting that it undertake a review as he had not received a response to his request for information.
3.The Board responded on 20 April 2007.In its response the Board confirmed that it was withholding the information requested on the basis that the documents in question fell within the definition of "personal data" as set out in section 1(1) of the DPA and also met the definition of "sensitive personal data" as set out in section (2)(e) of the DPA.As such, the Board confirmed that the information requested was exempt from disclosure under section 38(1)(a) of FOISA.
4.The Board went on to confirm that although it was withholding the information under the terms of FOISA, as Mr Wilson was the subject of the personal data in question it would process his request under the terms of the DPA. Consequently, the Board dealt with Mr Wilson's request as a subject access request and released the withheld information to him under the DPA.
5.On 25 April 2007, Mr Wilson wrote to the Board requesting a review of its decision.In particular, Mr Wilson drew the Board's attention to the time it had taken it to respond to his request.Mr Wilson also asked, however, that the Board confirm whether the information provided represented all the correspondence and records of requests by the named solicitors to Mr Wheelwright seeking an expert opinion in his claim for Personal Injury from 1996 to date. Specifically, he asked who supplied this information to the Board.
6.The Board responded to Mr Wilson on 27 April 2007.In this response the Board confirmed that his request for review was being processed.The Board also confirmed that it had identified two additional items of correspondence, which were forwarded to Mr Wilson (although one of these related to a different firm of solicitors from those listed by Mr Wilson). An apology was made by the Board for the oversight in not providing this information earlier.The Board confirmed that apart from these items, the information previously forwarded by the Board represented all the information it held which was applicable to the request.
7.On 23 May 2007, the Board wrote to Mr Wilson of the outcome of its review.In its response the Board acknowledged that it had failed to respond to Mr Wilson's initial request for information within the appropriate timescales and also accepted that the request for review was not acknowledged as a requirement for review and dealt with accordingly.The Board confirmed that both these circumstances represented failures by it to meet the requirements of FOISA and an apology was given for these.A copy of the review outcome, which detailed the recommendations made by the reviewer in relation to the Board's practice, was provided to Mr Wilson, with confirmation that these recommendations would be actioned.
8.On 9 July 2007, Mr Wilson wrote to the Commissioner's Office, stating that he was dissatisfied with the outcome of the Board's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
9.On 12 July 2007 the Board was notified in writing that an application had been received from Mr Wilson.During the validation process however it became evident that Mr Wilson had not received the Board's response to his request for review.Once this situation had been established, the Validation Officer arranged for a copy of the review outcome to be sent to Mr Wilson and he received this on 30 August 2007.He was dissatisfied with this response (believing further relevant information to be held by the Board) and the case was subsequently validated by establishing that Mr Wilson had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.The case was then allocated to an investigating officer.
Investigation
10.The investigating officer contacted the Board on 6 November 2007, to establish what information had been sent to Mr Wilson under the subject access request and to obtain the Board's comments on the application (as required by section 49(3)(a) of FOISA). In particular, the Board was asked to provide details of the searches undertaken to establish what relevant information it held and also to justify its reliance on any provisions of FOISA it considered applicable to the information requested. Finally, it was asked to comment on the technical aspects of its handling of the case.
11.On 27 November 2007, the Board provided detailed comments on this case, with a schedule of the documents already issued to Mr Wilson under the subject access request and copies of these documents.
12.During its searches, the Board identified three documents which had been supplied to Mr Wilson in part.The Board explained that Mr Wilson had received only the first page of each of these documents due to an administrative error (full copies being held in a separate file from that searched originally).The Board agreed to send Mr Wilson the full copies of these three documents, which Mr Wilson subsequently received.
13.In support of his assertion that the Board held further information falling within the scope of his request, Mr Wilson provided examples of correspondence in his possession which he considered relevant but which had not been provided in response to his request. Some, but not all, of this information fell within the scope of the request. The Board requested copies of the relevant items of correspondence to enable it to answer this point, but Mr Wilson would not agree to this. Given that the most that could be put to the Board in any event was that Mr Wilson held information which was clearly once held by the Board, this line of inquiry was not pursued further. Mr Wilson was advised of this.
Commissioner's analysis and findings
Section 38(1)(a) of FOISA ? Personal Information
14.Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject.This exemption exists under FOISA because data subjects have rights to access their own personal data, subject to certain qualifications and exemptions, under section 7 of the DPA.The rules under the DPA (which are framed with personal privacy in mind, rather than general access to information) will determine whether the person has a right to information about themselves. The effect of the exemption in section 38(1)(a), therefore, is not to deny individuals a right of access to information about themselves but to ensure the right is exercised under the appropriate legal regime.
15.As section 38(1)(a) is an absolute exemption, it is not subject to the public interest test set out in section 2(1)(b) of FOISA. Consequently, if the Commissioner finds that section 38(1)(a) applies to any of the information requested by Mr Wilson he cannot order the Board to disclose that information.
16."Personal data" and "data subject" are defined in section 1(1) of the DPA, which is reproduced in the Appendix below.
17.Having considered the information withheld from Mr Wilson under section 38(1)(a), the Commissioner is satisfied that it is all his personal data. Mr Wilson can be identified from the information, which is biographical of him in a significant sense and focuses on him.The Commissioner is therefore satisfied that the information relates to Mr Wilson. The information is therefore exempt from disclosure in its entirety under section 38(1)(a) of FOISA and the Board was therefore justified in withholding it from Mr Wilson under that section..
18.The Commissioner notes the release of the information (including that further information discovered either on review or during this investigation) to Mr Wilson under the DPA.
Whether the Board held further information relating to Mr Wilson's request
19.Given the terms of Mr Wilson's request, the Commissioner considers it highly unlikely that any information caught by it could be other than Mr Wilson's personal data and therefore subject to section 38(1)(a) of FOISA. He has, however, gone on to consider the steps taken by the Board to establish what information it held falling within the scope of the request, in case for any reason the request could be interpreted as embracing information which was not Mr Wilson's personal data.
20.The Commissioner has considered the submissions from both Mr Wilson and the Board and notes the steps taken by the Board to search across its various sets of records to locate the information Mr Wilson has requested. While not all the relevant information was identified in response to Mr Wilson's initial request, the Commissioner notes the more comprehensive searches undertaken in response to this investigation. Against this, the Commissioner can give little weight to the fact that Mr Wilson himself holds isolated items of correspondence which the Board clearly would have held copies of at one time, particularly given Mr Wilson's attitude to further engagement with the Board in relation to this information. In the circumstances, the Commissioner is satisfied as to the steps taken by the Board to establish what relevant information it held and accepts that neither at the time of Mr Wilson's request or subsequently did it hold further information falling within the scope of that request.
Technical issues
21.Part of Mr Wilson's application to the Commissioner focused on the Board's failure to respond to his initial request and request for review within the timescales set down by FOISA.
22.Section 10(1) of FOISA gives a Scottish public authority a maximum of 20 working days from receipt of the request to comply with a request for information, subject to certain exceptions which are not relevant to this case.
23.The Commissioner finds that the Board failed to respond to Mr Wilson's request for information within the 20 working days allowed by section 10(1) of FOISA. In failing to comply with this timescale, the Board failed to comply with Part 1 of FOISA.
24.Section 21(1) of FOISA gives the authority a maximum of 20 working days from receipt of the requirement to comply with a requirement for review, again subject to exceptions which are not relevant here.
25.In relation to the review, Mr Wilson is concerned that he was not provided with an apology from the Board's Acute Services Division in relation to delays in the handling of his request, as recommended by the reviewer, until 3 July 2007, following a request for review made on 25 April. The Commissioner is satisfied, however, that the review itself was carried out and notice of its outcome (which included a separate apology for the delays on behalf of the Board) sent to Mr Wilson within the 20 working day period laid down in section 21(1). Clearly the letter communicating the outcome of the review was not received by Mr Wilson at that time, but on balance the Commissioner is satisfied that this was not attributable to a failure on the Board's part and therefore cannot find any failure to comply with the timescales in section 21(1) as a consequence.
DECISION
The Commissioner finds that Greater Glasgow & Clyde NHS Board (the Board) generally complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Wilson.
The Commissioner finds that by withholding the information requested by Mr Wilson under section 38(1)(a) of FOISA, the Board complied with Part 1 of FOISA. The Commissioner is satisfied as to the steps taken by the Board to establish what information it held that might be covered by Mr Wilson's request and in the circumstances accepts that no further relevant information was held.
However, the Commissioner finds that the Board failed to comply with Part 1 of FOISA in dealing with Mr Wilson's information request, by failing to respond to the request within the relevant timescale laid down by section 10(1) of FOISA. Given that the Board has responded to both the initial request for information and Mr Wilson's request for review, the Commissioner does not require it to take any further action in response to this failure.
Appeal
Should either Mr Wilson or Greater Glasgow & Clyde NHS Board wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
20 May 2008
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1General entitlement
(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
2Effect of exemptions
(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a)the provision does not confer absolute exemption; and
...
(2)For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e)in subsection (1) of section 38 ?
(i)paragraphs (a), (c) and (d); and
...
10Time for compliance
(1) Subject to subsections (2) and (3), a Scottish public authority receiving a request which requires it to comply with section 1(1) must comply promptly; and in any event by not later than the twentieth working day after-
(a) in a case other than that mentioned in paragraph (b), the receipt by the authority of the request; or
?
38Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
?
Data Protection Act 1998
1Basic interpretative provisions
In this Act, unless the context otherwise requires ?
"data" means information which-
(a)is being processed by means of equipment operating automatically in response to instructions given for that purpose,
(b)is recorded with the intention that it should be processed by means of such equipment,
(c)is recorded as part of a relevant filling system or with the intention that it should form part of a relevant filling system, or
(d)does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68;
"data subject" means an individual who is subject of personal data;
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
